I built a scanner for AI-agent approval bypass paths

AI agents can have valid access to tools and APIs, but access is not the same thing as authority.

Suppose an agent is expected to reach production only through an approval boundary:

agent → approval → production deploy ✅

But the same repository may contain another execution path:

agent → shell → gh workflow run → production deploy ❌

I built an early open-source scanner to look for this specific class of problem.

It builds a modeled consequence path across Python and GitHub Actions and asks:

Is there another modeled route to the same real-world consequence that does not cross the expected approval boundary?

When it can prove such a path, it returns:

• COUNTEREXAMPLE_FOUND
• the path it followed
• source-code evidence

It deliberately does not claim full repository completeness.

UNKNOWN is not interpreted as safe, and COVERED_WITHIN_MODEL is limited to what the current model could analyze.

The current MVP is intentionally narrow:

• Python
• GitHub Actions
• production-deployment consequence paths

First run:

bash
python -m pip install .
consequence-boundary . --consequence production_deploy --boundary P

Repository:
https://github.com/othy19904-eng/agent-action-guard

I’m specifically looking for people building action-taking AI agents or automated workflows who can run it on a real repository.

The most useful feedback would be:

Did you get COUNTEREXAMPLE_FOUND, COVERED_WITHIN_MODEL, or UNKNOWN?

If it found a path, was it real or a false positive?

Would a check like this be useful enough to keep in CI?

This is an early demand test before I add more features.